Skip to content

Commit 02a81c4

Browse files
author
Wogan May
committed
Adding Omnibus image
1 parent 133367c commit 02a81c4

File tree

7 files changed

+324
-2
lines changed

7 files changed

+324
-2
lines changed

‎.github/workflows/build-omnibus.yml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
name: Build Omnibus
2+
3+
on:
4+
push:
5+
branches: [ "main" ]
6+
tags: [ 'v*.*' ]
7+
pull_request:
8+
branches: [ "main" ]
9+
10+
env:
11+
REGISTRY: ghcr.io
12+
IMAGE_NAME: ${{ github.repository }}
13+
14+
15+
jobs:
16+
build:
17+
18+
runs-on: ubuntu-latest
19+
permissions:
20+
contents: read
21+
packages: write
22+
# This is used to complete the identity challenge
23+
# with sigstore/fulcio when running outside of PRs.
24+
id-token: write
25+
26+
steps:
27+
- name: Checkout repository
28+
uses: actions/checkout@v4
29+
30+
- name: Set build variables
31+
id: build_vars
32+
run: |
33+
echo "IMAGE_NAME=${IMAGE_NAME,,}" >> $GITHUB_ENV
34+
35+
# Install the cosign tool except on PR
36+
# https://github.com/sigstore/cosign-installer
37+
- name: Install cosign
38+
if: github.event_name != 'pull_request'
39+
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
40+
with:
41+
cosign-release: 'v2.2.4'
42+
43+
# Set up BuildKit Docker container builder to be able to build
44+
# multi-platform images and export cache
45+
# https://github.com/docker/setup-buildx-action
46+
- name: Set up Docker Buildx
47+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
48+
49+
# Login against a Docker registry except on PR
50+
# https://github.com/docker/login-action
51+
- name: Log into registry ${{ env.REGISTRY }}
52+
if: github.event_name != 'pull_request'
53+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
54+
with:
55+
registry: ${{ env.REGISTRY }}
56+
username: ${{ github.actor }}
57+
password: ${{ secrets.GITHUB_TOKEN }}
58+
59+
# Extract metadata (tags, labels) for Docker
60+
# https://github.com/docker/metadata-action
61+
- name: Extract Docker metadata
62+
id: meta
63+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
64+
with:
65+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
66+
67+
# Build and push Docker image with Buildx (don't push on PR)
68+
# https://github.com/docker/build-push-action
69+
- name: Build and push Docker image
70+
id: build-and-push
71+
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
72+
with:
73+
context: omnibus
74+
push: ${{ github.event_name != 'pull_request' }}
75+
tags: |
76+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-omnibus:latest
77+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-omnibus:${{ github.ref_name }}
78+
labels: ${{ steps.meta.outputs.labels }}
79+
cache-from: type=gha
80+
cache-to: type=gha,mode=max
81+
82+
# Sign the resulting Docker image digest except on PRs.
83+
# This will only write to the public Rekor transparency log when the Docker
84+
# repository is public to avoid leaking data. If you would like to publish
85+
# transparency data even for private images, pass --force to cosign below.
86+
# https://github.com/sigstore/cosign
87+
- name: Sign the published Docker image
88+
if: ${{ github.event_name != 'pull_request' }}
89+
env:
90+
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
91+
TAGS: ${{ steps.meta.outputs.tags }}
92+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
93+
# This step uses the identity token to provision an ephemeral certificate
94+
# against the sigstore community Fulcio instance.
95+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎README.md‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@ This repo generates a Docker image that includes:
2222
* `artisan schedule:run` every minute via Supervisor
2323
* `openssh-client` for the `ssh` and `scp` commandline utilities
2424

25+
* In the Omnibus image:
26+
* The App + Worker images combined
27+
* Includes apache, php-fpm and supervisor for Horizon
28+
2529
These images publish to a public repository.
2630

2731
## Sample: Dockerfile for App container
@@ -42,7 +46,7 @@ CMD ["apache2-foreground"]
4246

4347
This build assumes that the Dockerfile is relative to your project root, so that index.php copies into /var/www/html/ on the container.
4448

45-
## Sample: Dockerfile for Worker container
49+
## Sample: Dockerfile for Worker/Omnibus container
4650

4751
```Dockerfile
4852
FROM ghcr.io/woganmay/laravel-runtime-worker:latest
@@ -53,4 +57,4 @@ WORKDIR /var/www/html
5357
COPY --chown=runtime . /var/www/html
5458
```
5559

56-
This build assumes that the Dockerfile is relative to your project root, so that index.php copies into /var/www/html/ on the container.
60+
This build assumes that the Dockerfile is relative to your project root, so that index.php copies into /var/www/html/ on the container.

‎omnibus/000-default.conf‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
<VirtualHost *:80>
2+
ServerAdmin webmaster@localhost
3+
ServerName app
4+
DocumentRoot /var/www/html/public
5+
ErrorLog ${APACHE_LOG_DIR}/error.log
6+
CustomLog ${APACHE_LOG_DIR}/access.log combined
7+
8+
<Directory "/var/www/html/public">
9+
<IfModule mod_rewrite.c>
10+
<IfModule mod_negotiation.c>
11+
Options -MultiViews -Indexes
12+
</IfModule>
13+
14+
RewriteEngine On
15+
16+
# Handle Authorization Header
17+
RewriteCond %{HTTP:Authorization} .
18+
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
19+
20+
# Redirect Trailing Slashes If Not A Folder...
21+
RewriteCond %{REQUEST_FILENAME} !-d
22+
RewriteCond %{REQUEST_URI} (.+)/$
23+
RewriteRule ^ %1 [L,R=301]
24+
25+
# Send Requests To Front Controller...
26+
RewriteCond %{REQUEST_FILENAME} !-d
27+
RewriteCond %{REQUEST_FILENAME} !-f
28+
RewriteRule ^ index.php [L]
29+
</IfModule>
30+
</Directory>
31+
32+
</VirtualHost>

‎omnibus/Dockerfile‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
FROM php:8.3-apache
2+
# TODO: FROM php:8.3-cli
3+
4+
WORKDIR /var/www/html
5+
6+
RUN mkdir -p /usr/local/lib/php/extensions/no-debug-non-zts-20230831/modules
7+
8+
# Install the PostgreSQL PDO extension
9+
# Docs: https://github.com/mlocati/docker-php-extension-installer
10+
RUN apt-get update && \
11+
apt-get install wget && \
12+
echo 'deb [signed-by=/usr/share/keyrings/postgresql.gpg] https://apt.postgresql.org/pub/repos/apt trixie-pgdg main' > /etc/apt/sources.list.d/pgdg.list && \
13+
wget --quiet -O /usr/share/keyrings/postgresql.gpg https://www.postgresql.org/media/keys/ACCC4CF8.asc && \
14+
apt-get update && \
15+
apt-get install -y libpq-dev libzip-dev libjpeg-dev libpng-dev libwebp-dev libfreetype-dev libcurl4-openssl-dev libxml2-dev libonig-dev libssh2-1-dev supervisor openssh-client postgresql-client-17 default-mysql-client && \
16+
pecl install redis-6.0.2 ssh2-1.4.1 && \
17+
docker-php-ext-configure gd --with-jpeg --with-webp --with-freetype && \
18+
docker-php-ext-configure pgsql -with-pgsql=/usr/local/pgsql && \
19+
docker-php-ext-install pgsql pdo pdo_pgsql zip pcntl bcmath curl dom mbstring pdo_mysql mysqli && \
20+
docker-php-ext-install gd && \
21+
docker-php-ext-enable redis bcmath curl dom mbstring ssh2 && \
22+
rm -rf /var/lib/apt/lists/*
23+
24+
# Install the latest Composer
25+
RUN php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" && \
26+
php -r "if (hash_file('sha384', 'composer-setup.php') === 'ed0feb545ba87161262f2d45a633e34f591ebb3381f2e0063c345ebea4d228dd0043083717770234ec00c5a9f9593792') { echo 'Installer verified'.PHP_EOL; } else { echo 'Installer corrupt'.PHP_EOL; unlink('composer-setup.php'); exit(1); }" && \
27+
php composer-setup.php --install-dir=/usr/bin/ --filename=composer && \
28+
php -r "unlink('composer-setup.php');"
29+
30+
# Copy our prod-ready configs in
31+
COPY ./security.conf /etc/apache2/conf-available/security.conf
32+
COPY ./php.ini /usr/local/etc/php/php.ini
33+
COPY ./000-default.conf /etc/apache2/sites-available/000-default.conf
34+
RUN a2enmod rewrite
35+
36+
# Create a non-root runtime user with group 33 (apache's www-data group)
37+
RUN groupadd --force -g 33 runtime
38+
RUN useradd -ms /bin/bash --no-user-group -g 33 -u 1337 runtime
39+
40+
# Add a config to run php artisan horizon against the mounted source code and keep that alive
41+
COPY ./supervisord.conf /etc/supervisor/supervisord.conf
42+
43+
# Run supervisor on start
44+
CMD ["/usr/bin/supervisord"]

‎omnibus/php.ini‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
[PHP]
2+
engine = On
3+
short_open_tag = Off
4+
precision = 14
5+
output_buffering = 4096
6+
zlib.output_compression = Off
7+
implicit_flush = Off
8+
unserialize_callback_func =
9+
serialize_precision = -1
10+
disable_functions =
11+
disable_classes =
12+
zend.enable_gc = On
13+
zend.exception_ignore_args = On
14+
zend.exception_string_param_max_len = 0
15+
expose_php = Off
16+
max_execution_time = 30
17+
max_input_time = 60
18+
memory_limit = 128M
19+
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
20+
display_errors = Off
21+
display_startup_errors = Off
22+
log_errors = On
23+
ignore_repeated_errors = Off
24+
ignore_repeated_source = Off
25+
report_memleaks = Off
26+
variables_order = "GPCS"
27+
request_order = "GP"
28+
register_argc_argv = Off
29+
auto_globals_jit = On
30+
post_max_size = 8M
31+
auto_prepend_file =
32+
auto_append_file =
33+
default_mimetype = "text/html"
34+
default_charset = "UTF-8"
35+
doc_root =
36+
user_dir =
37+
enable_dl = Off
38+
file_uploads = On
39+
upload_max_filesize = 2M
40+
max_file_uploads = 20
41+
allow_url_fopen = On
42+
allow_url_include = Off
43+
default_socket_timeout = 60
44+
45+
[CLI Server]
46+
cli_server.color = On
47+
48+
[Date]
49+
date.timezone = UTC
50+
51+
[Pdo_mysql]
52+
pdo_mysql.default_socket=
53+
54+
[ODBC]
55+
odbc.allow_persistent = On
56+
odbc.check_persistent = On
57+
odbc.max_persistent = -1
58+
odbc.max_links = -1
59+
odbc.defaultlrl = 4096
60+
odbc.defaultbinmode = 1
61+
62+
[MySQLi]
63+
mysqli.max_persistent = -1
64+
mysqli.allow_persistent = On
65+
mysqli.max_links = -1
66+
mysqli.default_port = 3306
67+
mysqli.default_socket =
68+
mysqli.default_host =
69+
mysqli.default_user =
70+
mysqli.default_pw =
71+
72+
[mysqlnd]
73+
mysqlnd.collect_statistics = On
74+
mysqlnd.collect_memory_statistics = Off
75+
76+
[PostgreSQL]
77+
pgsql.allow_persistent = On
78+
pgsql.auto_reset_persistent = Off
79+
pgsql.max_persistent = -1
80+
pgsql.max_links = -1
81+
pgsql.ignore_notice = 0
82+
pgsql.log_notice = 0
83+
84+
[bcmath]
85+
bcmath.scale = 0
86+
87+
[Session]
88+
session.save_handler = files
89+
session.use_strict_mode = 0
90+
session.use_cookies = 1
91+
session.use_only_cookies = 1
92+
session.name = PHPSESSID
93+
session.auto_start = 0
94+
session.cookie_lifetime = 0
95+
session.cookie_path = /
96+
session.cookie_domain =
97+
session.cookie_httponly =
98+
session.cookie_samesite =
99+
session.serialize_handler = php
100+
session.gc_probability = 1
101+
session.gc_divisor = 1000
102+
session.gc_maxlifetime = 1440
103+
session.referer_check =
104+
session.cache_limiter = nocache
105+
session.cache_expire = 180
106+
session.use_trans_sid = 0
107+
session.sid_length = 26
108+
session.trans_sid_tags = "a=href,area=href,frame=src,form="
109+
session.sid_bits_per_character = 5
110+
111+
[Assertion]
112+
zend.assertions = -1
113+
114+
[Tidy]
115+
tidy.clean_output = Off
116+
117+
[soap]
118+
soap.wsdl_cache_enabled=1
119+
soap.wsdl_cache_dir="/tmp"
120+
soap.wsdl_cache_ttl=86400
121+
soap.wsdl_cache_limit = 5
122+
123+
[ldap]
124+
ldap.max_links = -1

‎omnibus/security.conf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
ServerTokens Prod
2+
ServerSignature Off
3+
TraceEnable Off

‎omnibus/supervisord.conf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
[supervisord]
2+
nodaemon=true
3+
4+
[program:worker]
5+
process_name=worker
6+
command=php /var/www/html/artisan horizon
7+
autostart=true
8+
autorestart=true
9+
user=runtime
10+
stdout_logfile=/var/www/html/storage/worker.log
11+
stderr_logfile=/var/www/html/storage/worker.err
12+
13+
[program:scheduler]
14+
process_name=worker
15+
command=/bin/bash -c "while true; do php /var/www/html/artisan schedule:run --verbose --no-interaction; sleep 60; done"
16+
autostart=true
17+
autorestart=unexpected
18+
user=runtime
19+
stdout_logfile=/var/www/html/storage/scheduler.log
20+
stderr_logfile=/var/www/html/storage/scheduler.err

0 commit comments

Comments
 (0)